...
EAP and RADIUS are both general purpose protocols that take care of communication. They have support for a great variety of features or different methods to perform authentication (e.g. it is possible to use different protocols that authenticate the user using a username and password, or using client certificates, or even SIM cards), but it is still up to the supplicant, NAS and authentication server implementations to choose which ones they support or not (even different NASes have been seen to send MAC addresses in different format, e.g. TP-Link Archer C20 sends 01-23-45-67-89-AB, while TP-Link TD-W8968 sends 0123456789ab). In fact, EAP is only a tunneling protocol inside which a suitable protocol for performing authentication needs to be used. This makes it possible to have flexibility in usable authentication protocols whilst maintaining compatibility with any NAS, as long as the authentication protocol is supported by both the supplicant and authentication server.
...
In absence of the above mentioned feature, once a user has connected, there is no way to disconnect them other than rebooting the NAS. If the system administrator chooses to disable a user account on the authentication server, the user will be denied access only from the next time they try to connect, if they are already connected at the time of disabling the account, they will remain connected for the moment. It is possible for the authentication server to specify with the "Session-Timeout" and "Termination-Action" attributes of the Access-Accept packet for how long a user is allowed to remain connected without repeating authentication (again subject to NAS supporting). Depending on the NAS and supplicant models it has been observed that there can be a new authentication request, in the case of wifi, when the supplicant moves out of range of the wifi and then comes back, or when the user switches wifi off and on again on the supplicant, but might also not be the case.
Things to mention:
What RADIUS/802.1X is able to provide and not and in which situations.
Proxying
MAC address format differences
Misc. Information:
- A "User-Name" attribute is usually provided in both the outer and inner tunnels, often referred to as outer identity and inner identity, respectively. It is often suggested to send the real username only in the inner tunnel for privacy reasons as it is encrypted, and send the string 'anonymous' as User-Name in the outer tunnel, it was found, however, to be unreasonably difficult, if at all possible, to configure Mac OS, Windows and iPhone clients to do so. The 'User-Name' attribute in the outer tunnel is still necessary as a realm for the user may be specified which might need to be accessed by a RADIUS server which might forward the request and be unable to read the encrypted part. If the user name is anonymized and a realm needs to be specified, the attribute would read 'anonymous@realm'.
- It is possible for a FreeRADIUS server to forward a request to an upstream RADIUS server to handle. The answer then gets sent back and the local FreeRADIUS server forwards it to the client. Usually intermediary RADIUS servers are not able to decrypt the data within the SSL tunnel, and do not have access to it. One way for a RADIUS server to determine whether it should answer a given query itself or forward it upstream is to look at the domain part of the outer identity provided in the outer tunnel.
Things to mention:
Proxying
features supported by TP-Link NASes
...
Difference between auth systems: PEAP, TTLS, TLS
Certificates
Outer and inner identity and MAC/Windows support
Wifi keying, session timeout, etc. protections against MAC-spoofing, etc.
...
freeradius -X. radiusd vs freeradius
Outer and inner identity and MAC/Windows support - Done
What RADIUS/802.1X is able to provide and not and in which situations. - Done
RADIUS is the protocol, it can be used for many purposes and many authentication methods can be used. - Done
MAC address format differences - Done
Difference between 802.1X and RADIUS and FreeRADIUS - Done
...